Vulnerability Details CVE-2024-29974
** UNSUPPORTED WHEN ASSIGNED **
The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute arbitrary code by uploading a crafted configuration file to a vulnerable device.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.548
EPSS Ranking 97.9%
CVSS Severity
CVSS v3 Score 9.8
References
- https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024
- https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024
Products affected by CVE-2024-29974
-
cpe:2.3:h:zyxel:nas326:-
-
cpe:2.3:h:zyxel:nas542:-
-
cpe:2.3:o:zyxel:nas326_firmware:-
-
cpe:2.3:o:zyxel:nas326_firmware:5.21
-
cpe:2.3:o:zyxel:nas326_firmware:5.21(aazf.12)c0
-
cpe:2.3:o:zyxel:nas326_firmware:5.21(aazf.13)c0
-
cpe:2.3:o:zyxel:nas326_firmware:5.21(aazf.14)c0
-
cpe:2.3:o:zyxel:nas326_firmware:5.21(aazf.16)c0
-
cpe:2.3:o:zyxel:nas326_firmware:5.21(aazf.7)c0
-
cpe:2.3:o:zyxel:nas542_firmware:-
-
cpe:2.3:o:zyxel:nas542_firmware:5.21(abag.10)c0
-
cpe:2.3:o:zyxel:nas542_firmware:5.21(abag.11)c0
-
cpe:2.3:o:zyxel:nas542_firmware:5.21(abag.13)c0
-
cpe:2.3:o:zyxel:nas542_firmware:5.21(abag.4)c0
-
cpe:2.3:o:zyxel:nas542_firmware:5.21(abag.9)c0